| CVE-2026-84183 |
Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-84728 |
Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-85627 |
Apache OFBiz: Authenticated Code Execution Vulnerability
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-92887 |
Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-97355 |
Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-97356 |
Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-100168 |
Apache OFBiz: Missing Authorization vulnerability
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-100228 |
Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-105325 |
Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-105330 |
Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-105461 |
Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-109129 |
Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-109837 |
Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-109856 |
Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-109928 |
Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-114229 |
Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-114233 |
Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-114235 |
Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-114271 |
Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-114272 |
Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-114277 |
Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts
|
Not rated
|
Nov 5, 2026 |
| CVE-2026-47342 |
A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher…
|
Not rated
|
Jun 10, 2026 |
| CVE-2026-50223 |
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged…
|
Not rated
|
Jun 10, 2026 |
| CVE-2026-46586 |
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically…
|
Not rated
|
May 19, 2026 |
| CVE-2026-45434 |
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
|
Not rated
|
May 19, 2026 |